Privacy Policy
Onzio is a two-player football knowledge game. This policy explains what data is processed when you use the app and the onzio.online website, how long it is kept, and what rights you have. It also serves as the information notice under Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and, for users in the EEA, UK and Switzerland, under the GDPR.
In short: we do not ask for registration, an email address or a password; we do not access your location, contacts or photos; we do not show personalised ads (the only ads are optional rewarded ads); and you can delete your account in the app at any time.
Data controller
The controller of your personal data is Oğuzhan. Contact: [email protected]
What data we process
- Anonymous device account: On first launch the app generates a random ID and stores it in the device’s secure storage. It is not an advertising ID and is not linked to your phone number, IMEI or other accounts. It is used to recognise your account on the server.
- Profile: An optional nickname and your favourite team. Your nickname, favourite team, trophy count and league are visible to opponents and, on leaderboards, to other players.
- Gameplay data: The matches you play (mode, opponent, score, trophy change, match log), your trophy and league information, your My Team squad, cards and progress, your in-game coin balance, your daily mission and challenge results, your streak, and your participation in friend rooms and tournaments.
- Optional account linking (Sign in with Apple, Google): If you link your account to an Apple or Google identity, only the stable user ID issued by the provider is stored. Your email address and name are not stored. This ID is used only to recover your account on a new phone.
- Notifications (if you allow them): Your notification token, your platform (iOS/Android), your app build number and the notification categories you enabled are stored. Notifications are delivered through the push delivery services of Apple, Google and Expo. You can turn notifications off in the app settings or in your device settings.
- Purchases (optional): If you buy “+10 matches”, we store on our own server your extra-match balance, the purchase transaction ID, the product, the store (App Store / Google Play) and the time of purchase. Your card or payment details never reach us or RevenueCat; Apple or Google takes the payment.
- Disputes: The type and content of a dispute you submit about an answer or game data, and the related match information.
- Error logs: When the app crashes, your device model, operating system and app version, screen name and error stack may be sent to our own server. Your IP address is not stored with the error log.
- Device and app information: When you connect to the server we record your platform (iOS, Android or web), operating system and app version, build number, device model, language, region and time zone settings, your first and last connection time and your session count. We do not store your location, IP address or device name for this purpose.
- Usage metrics: In-app events chosen from a fixed list, such as opening the app, moving between screens and pressing “Play”, are recorded with your account on our own server. We do not use a third-party analytics service. These records contain no free text, nickname or IP address.
- Security records: To prevent cheating: suspicious-behaviour signals (for example answer speed that is impossible for a human), match-abandonment counters and sanctions applied (cooldown, ban).
- Technical data: To prevent server overload and abuse, request frequency is monitored per IP address at minute level using short-lived counters. For iOS users arriving through a friend invite link, so that they can join the room after installing, the IP address and device characteristics are converted into a keyed, irreversible signature and kept for at most 60 minutes; the raw IP address is not stored.
- This website: This promotional site uses no cookies and contains no tracking or analytics tools. The server that delivers the site may briefly keep your IP address and request details in standard access logs.
Rewarded ads (Google AdMob)
Onzio has rewarded ads only: an ad is shown only if you choose to watch it in exchange for an in-game reward (for example extra coins or a card pack allowance). No ads appear during matches or on their own. Ads are served by Google AdMob (Google).
- Non-personalised ads: We send our ad requests as “non-personalised ads only”. A request contains only football-related contextual keywords and the app’s web address; we do not build an interest profile about you.
- Consent (EU/EEA, UK, Switzerland): In these regions, Google’s consent form (User Messaging Platform) is shown before any ad is requested. If you do not consent, or consent cannot be obtained, the ads SDK is not started and no ad is shown. You can change your choice at any time under “Ad privacy options” in Settings (shown where required).
- Data processed by Google: To deliver the ad, limit how often it is shown, measure it and prevent fraud, Google may process data such as your IP address, device and app information (including device identifiers such as an advertising ID) and your interaction with the ad. Google processes this data under its own privacy policy: policies.google.com/privacy and how Google uses data when you use partner sites or apps.
- Reward verification: The reward is granted by our server. For this, your anonymous in-app account ID and a random transaction ID are passed to Google with the ad request; when the ad has been watched, Google sends them back to our server in a signed notification.
- Tracking permission: We do not request Apple’s App Tracking Transparency permission, we do not read the advertising ID for our own purposes, and we do not sell your data to third parties for advertising.
- Age: Onzio is intended for users aged 13 and over and is not directed at children. Ad content is limited to a maximum “Teen” (13+) rating.
You can decline ads entirely: rewarded ads are optional and you do not need to watch any to play the core modes. To reset your device’s advertising ID or turn off ad personalisation, use your device settings (iOS: Privacy & Security; Android: Google settings, Ads).
In-app purchase (RevenueCat)
The only thing sold for real money in Onzio is one consumable product: “+10 matches” (shown when your free daily matches run out). The purchase is made through the App Store or Google Play; your payment details (card, bank account etc.) are not sent to us or to RevenueCat, the store handles them. A random card pack is never sold for real money.
- RevenueCat, Inc. (USA), our data processor: We use RevenueCat to verify purchases and credit them to your account. On devices where the purchase offer is available, the app starts the RevenueCat SDK, and RevenueCat receives: your anonymous in-app account ID, purchase history and transaction ID, product, store, country and currency, and device and app version. RevenueCat may also see your IP address when the SDK connects. We do not send your name, email address or nickname.
- Verification: The store transaction reaches our server through a signed notification (webhook) from RevenueCat and through the app’s own sync request; each transaction credits matches only once.
- Nature of the matches: Purchased matches are tied to your account, never expire and are used after your free daily matches. They cannot be transferred or converted into money. If you delete your account, unused matches are deleted.
RevenueCat also processes this data under its own privacy policy: revenuecat.com/privacy. Refunds and the right of withdrawal are explained in the Terms of Use.
Data we do not collect
- We do not request access to your location, contacts, photos, camera or microphone.
- We have no tracking cookies of our own and no third-party analytics or crash-reporting software. The only third-party software is the Google ads SDK and the RevenueCat purchase SDK described above (and Apple/Google sign-in if you link an account).
- There is no free chat; players can only send ready-made reactions.
- We do not process card, bank or other payment details; the App Store or Google Play takes the payment. Only “+10 matches” is sold for real money; no random packs are sold.
- We do not use player photos, club logos or kit images.
Purposes and legal bases
- Opening your account and providing matchmaking, matches, trophies, leagues, leaderboards and My Team: performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
- Preventing cheating and abuse, ensuring fair play and server security, fixing bugs, resolving disputes, monitoring version and device compatibility, producing aggregate usage statistics: legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)). We take care that these interests do not override your fundamental rights and freedoms.
- Sending notifications: your permission (consent; KVKK Art. 5/1; GDPR Art. 6(1)(a)). You can withdraw it at any time.
- Showing rewarded ads, and Google’s consent form where consent is required: your consent (GDPR Art. 6(1)(a) and ePrivacy); in other regions, legitimate interests.
- Verifying purchases and crediting purchased matches to your account: performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)). Keeping purchase records for tax and accounting duties: legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
- Complying with lawful requests from authorities: legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
Linking an Apple or Google account is entirely your choice.
Sharing and transfers
We do not sell or rent your personal data.
- Other players: Your nickname, favourite team, trophy count, league and match results are visible to your opponents and, on leaderboards, to other players.
- Infrastructure providers: Our servers and database are hosted with a cloud provider (Hetzner); web traffic passes through Cloudflare for security and speed. These providers act only to deliver the service.
- Google (AdMob): Only when a rewarded ad is requested, as described under “Rewarded ads” above.
- RevenueCat, Inc. (USA): Only on devices where the purchase offer is available, to verify purchases, as described under “In-app purchase” above. Apple and Google take the payment under their own terms; we never see your payment details.
- Apple and Google (account linking): Only if you choose to link an account, we contact the provider to verify your identity token.
- Notification services: If you allowed notifications, your notification token and the notification content pass through the delivery services of Apple, Google and Expo.
- Authorities: Where legally required, and only to the extent necessary.
International transfers
Providers such as Google, Cloudflare, Expo, Apple and RevenueCat, Inc. (USA) may process data outside Turkey and the European Economic Area, in particular in the United States. Such transfers are made with safeguards that comply with KVKK Art. 9 and, for EEA/UK users, the transfer rules of the GDPR (for example standard contractual clauses).
Retention periods
- Account and gameplay data: Kept while your account is open.
- Device and app information: Kept until you delete your account; deleted immediately when you delete your account, even if the account is banned.
- Usage metrics: At most 90 days.
- Notification tokens: Deleted when you turn notifications off or delete your account.
- Purchase records: The transaction ID, product, store, number of matches credited and date are kept for 10 years under Turkish tax and commercial-law retention obligations (Tax Procedure Law, Commercial Code). Deleting your account does not delete them, but they remain anonymous and can no longer be linked to you.
- Purchased match balance: Kept while your account is open; unused matches are deleted when you delete your account.
- At RevenueCat: Subject to RevenueCat’s own retention rules; after you delete your account, the ID can no longer be linked to you. You can ask us at [email protected] to have the record deleted at RevenueCat (except records we must keep by law).
- When you delete your account: Your nickname, favourite team, trophy and league information, device ID link, linked Apple/Google identity, device and app information, daily mission and challenge records and fan counters are deleted immediately or stripped of their personal link.
- Match records: Match records remain so that your opponents’ match history is not broken; you appear in them as “Deleted player” and the record can no longer be linked to you.
- Active ban: If your account is banned, the sanction record and the device ID link are kept for as long as the ban lasts, to prevent the ban from being evaded; your profile information is still deleted.
- Disputes: When your account is deleted, your disputes can no longer be linked to you.
- Error logs: At most 30 days.
- Temporary data: The matchmaking queue, friend rooms (at most 15 minutes), in-progress match state and rate-limit counters are deleted automatically within minutes to hours.
- Server logs: Standard access logs may contain IP addresses and are kept for at most 30 days.
- At Google: Data Google processes during an ad is subject to Google’s own retention rules; deleting your account does not cover it.
Deleting your account
In the app, go to Profile → Settings → “Delete my account” and confirm by typing the requested word “DELETE”. Deletion cannot be undone. Details: Delete account.
Uninstalling the app does not delete your account. If you cannot access the app, you can send a deletion request to [email protected].
Children
Onzio is not directed at children under 13 and we do not knowingly collect personal data from this age group. If we learn that a child under 13 has created an account, we will delete it. If you are a parent or guardian and believe your child has created an account, write to [email protected].
Security
Communication between the app and the server uses an encrypted connection. Hidden in-game data such as player values is not sent to the device during a match; the server runs the match. No system is completely risk-free; if we become aware of a breach we will make the notifications required by applicable law.
Your rights
Under KVKK Art. 11 you may apply to the controller to:
- learn whether your personal data is processed and request information about it;
- learn the purpose of processing and whether it is used accordingly;
- know the third parties to whom it is transferred in Turkey or abroad;
- request correction if it is incomplete or inaccurate;
- request deletion or destruction under KVKK Art. 7 and have this notified to third parties to whom data was transferred;
- object to a result against you arising from analysis exclusively by automated systems;
- claim compensation if you suffer damage from unlawful processing.
If you live in the EEA, the UK or Switzerland, you also have the GDPR rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests, and you may withdraw consent at any time (withdrawal does not affect processing before it). You have the right to lodge a complaint with your local data protection authority.
Send requests to [email protected]. Because the app does not require registration, please state your nickname, favourite team and approximate trophy count so that we can identify your account; we may ask for additional information to verify the request. We will respond within 30 days at most, depending on the nature of the request. If you are not satisfied with our answer, you can complain to the Personal Data Protection Board in Turkey. You do not need to file a request to delete your account; you can delete it yourself in the app.
Changes
We may update this policy. The current text is always published at this address and the effective date at the top changes. We will separately announce changes that materially affect how your data is used, in the app or in release notes.
Contact
Oğuzhan — [email protected]